Git-aware utility for automated program analysis
[alpha] A Git-aware CLI for running semgrep patterns in the developer and CI workflow.
In a Git project directory:
$ pip3 install bento-headless
$ pip3 install --upgrade bento-headless
Command line options
$ bentoh --help Usage: bentoh [OPTIONS] COMMAND [ARGS]... Options: -h, --help Show this message and exit. --version Show the version and exit. Commands: archive Suppress current findings. check Checks for new findings. To get help for a specific command, run `bentoh COMMAND --help`
semgrep checks on staged diffs
See semgrep Configuration for how to write custom rule files
vi .bento/semgrep.yml bentoh check
Format output as JSON
bentoh check -f json
Run on file system current state
bentoh check --all
Run on staged diffs in a directory
bentoh check src
Ignore current findings
Run public semgrep checks on staged diffs
BENTO_REGISTRY=r/r2c.python bentoh check
Run checks from extensions
bentoh check -t gosec -t r2c.registry.latest
bentoh check may exit with the following exit codes:
0: Bento ran successfully and found no errors
2: Bento ran successfully and found issues in your code
3: Bento or one of its underlying tools failed to run
bentoh ships with the following extensions:
|bandit||Finds common security issues in Python code|
|dlint||A tool for encouraging best coding practices and helping ensure Python code is secure|
|flake8||Finds common bugs in Python code|
|gosec||Finds security bugs in Go code|
|hadolint||Finds bugs in Docker files (requires Docker)|
|r2c.boto3||Checks for the AWS boto3 library in Python|
|r2c.flask||Checks for the Python Flask framework|
|r2c.jinja||Finds common security issues in Jinja templates|
|r2c.registry.latest||Runs checks from r2c's check registry (experimental; requires Docker)|
|r2c.requests||Checks for the Python Requests framework|
|shellcheck||Finds bugs in shell scripts (requires Docker)|
Help and community
Need help or want to share feedback? We’d love to hear from you!
- Email us at firstname.lastname@example.org
- Join #general in our community Slack
- File an issue or submit a feature request directly on GitHub
We’re constantly shipping new features and improvements.
License and legal
Please refer to the terms and privacy document.
Copyright (c) r2c.
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Hashes for bento_headless-0.11.2-py3-none-any.whl